CCNA NAT, PAT and Port Forwarding Practice Questions

How to work these questions

1. Check the interface roles first: run show ip nat statistics and confirm the LAN-facing interfaces are listed as inside and the ISP-facing interface as outside.
2. Check the ACL that the NAT rule references with show access-lists: the inside hosts' source addresses must match a permit entry, and the match counters should increase when users send traffic.
3. Read the ip nat inside source command in show running-config: correct ACL number, correct pool or interface name, and overload present if many hosts must share few addresses.
4. Check routing: the router needs a route to the destination (usually a default route), and the ISP must route the inside global addresses back to you.
5. Generate traffic from an inside host and watch show ip nat translations; an empty table points to interface roles, the ACL or routing, while pool misses in show ip nat statistics point to exhaustion.
6. After a configuration change, clear stale dynamic entries with clear ip nat translation * and test again.

Practice questions

Pick an answer to see right away whether it is correct and why every option is right or wrong.

1. Question 1 of 10Concept

   A PC with address 192.168.10.20 sits behind router R1. R1 translates the PC's traffic to 203.0.113.10 before sending it to a web server at 198.51.100.50. No translation is configured for the server's address. Which NAT term describes 203.0.113.10?

   1. Inside global
   2. Inside local
   3. Outside global
   4. Outside local
   Show the answer

   Answer: A

   Inside and outside describe where the host is; local and global describe from which side you are looking at the address. The inside host's translated public address is the inside global address. With no outside NAT, outside local and outside global are the same address.

   • A. Inside global is the address that represents the inside host to the outside world after translation, which is 203.0.113.10.
   • B. Inside local is the address of the inside host as seen on the inside network, which is 192.168.10.20, not 203.0.113.10.
   • C. Outside global is the real address of the outside host on the outside network, again 198.51.100.50, not the PC's translated address.
   • D. Outside local is the address of the outside host as it appears to the inside network; here that is the server's 198.51.100.50.

2. Question 2 of 10Exhibit

   Refer to the exhibit. Which statement about R1 is correct?

   R1# show ip nat translations
   Pro  Inside global        Inside local          Outside local         Outside global
   tcp  203.0.113.2:51544    192.168.10.11:51544   198.51.100.80:443     198.51.100.80:443
   tcp  203.0.113.2:1024     192.168.10.12:51544   198.51.100.80:443     198.51.100.80:443
   udp  203.0.113.2:4921     192.168.10.13:4921    192.0.2.53:53         192.0.2.53:53

   1. R1 is translating the outside server addresses, because the outside columns are filled in.
   2. 203.0.113.2 is the inside local address of the three hosts, and the 192.168.10.x addresses are inside global.
   3. R1 is performing PAT, and several inside hosts share the inside global address 203.0.113.2.
   4. R1 has static NAT entries that permanently map each inside host to 203.0.113.2.
   Show the answer

   Answer: C

   Many inside local addresses mapped to one inside global address with unique ports is the signature of PAT. When outside local and outside global match, only the inside source is translated. IOS tries to keep the original source port and picks another one when it is already taken.

   • A. Outside local equals outside global in every row, which means the outside addresses are not being translated. The columns are filled because extended (port) entries record the remote endpoint.
   • B. The inside local addresses are the 192.168.10.x addresses; 203.0.113.2 is the inside global address, so the roles are reversed.
   • C. Three different inside local addresses map to the same inside global address with different ports, which is PAT (overload). R1 changed the port to 1024 for the second host because 51544 was already in use.
   • D. Static entries do not look like this; a basic static entry shows only the inside addresses with dashes in the protocol and outside columns, and one global address cannot be statically mapped to three hosts without ports.

3. Question 3 of 10Exhibit

   Refer to the exhibit. Users on 192.168.20.0/24 cannot reach the internet, and show ip nat translations is empty while they generate traffic. What is the fix?

   interface GigabitEthernet0/0
    description LAN
    ip address 192.168.20.1 255.255.255.0
    ip nat outside
   !
   interface GigabitEthernet0/1
    description ISP
    ip address 203.0.113.6 255.255.255.252
    ip nat inside
   !
   access-list 20 permit 192.168.20.0 0.0.0.255
   ip nat inside source list 20 interface GigabitEthernet0/1 overload
   ip route 0.0.0.0 0.0.0.0 203.0.113.5

   1. Replace the interface keyword with a NAT pool, because overload cannot use an interface address.
   2. Configure ip nat inside on GigabitEthernet0/0 and ip nat outside on GigabitEthernet0/1.
   3. Remove the default route so NAT can choose the exit interface from the inside source rule.
   4. Change the access list wildcard to 255.255.255.0 so it matches the 192.168.20.0/24 subnet.
   Show the answer

   Answer: B

   ip nat inside belongs on the interface facing the private hosts, ip nat outside on the interface facing the ISP. With the roles swapped, IOS accepts the config but never translates anything. Always check the inside and outside interface lists in show ip nat statistics first.

   • A. PAT on the outside interface address with ip nat inside source list 20 interface GigabitEthernet0/1 overload is valid and very common.
   • B. The interface roles are swapped: the LAN is marked outside and the ISP link inside. The inside source rule only translates traffic going from an inside interface to an outside interface, so nothing matches.
   • C. The default route is needed to send traffic toward the ISP. Removing it would add a second fault, not fix the first.
   • D. IOS ACLs use wildcard masks, and 0.0.0.255 already matches the whole 192.168.20.0/24 subnet. 255.255.255.0 would match the wrong addresses.

4. Question 4 of 10Scenario

   R3 uses dynamic NAT for 192.168.30.0/24 with ip nat pool OFFICE 203.0.113.33 203.0.113.38 netmask 255.255.255.248 and ip nat inside source list 30 pool OFFICE. Every morning the first six users browse normally, but the seventh and later users get no internet access until some translations time out. The pool misses counter in show ip nat statistics keeps increasing. What is the most likely cause?

   1. The ISP-facing interface is missing ip nat outside, so return traffic is not translated back.
   2. The six-address pool is exhausted because the NAT rule has no overload keyword.
   3. ACL 30 does not match the 192.168.30.0/24 subnet, so those hosts are never translated.
   4. R3 has no default route toward the ISP, so traffic for the internet is dropped.
   Show the answer

   Answer: B

   A failure that starts after exactly as many users as there are pool addresses points to pool exhaustion. Dynamic NAT is one-to-one; PAT with overload lets many hosts share the pool. Pool misses in show ip nat statistics confirm the diagnosis.

   • A. Without ip nat outside on the ISP interface, no traffic would be translated at all, so the first six users would also fail.
   • B. Dynamic NAT without overload maps one inside host to one pool address. Six addresses serve six hosts; the rest fail and show up as pool misses until an entry expires. Adding overload to the ip nat inside source command fixes it.
   • C. If the ACL did not match the subnet, no user would be translated, not only the users after the sixth.
   • D. A missing default route would affect every user from the first packet, not only after six translations exist.

5. Question 5 of 10Config

   An internal web application runs on 192.168.1.10 TCP port 8080. Internet users must reach it at 203.0.113.5 on TCP port 80. Interfaces are already configured with ip nat inside and ip nat outside. Which command completes the configuration?

   1. ip nat inside source static tcp 192.168.1.10 8080 203.0.113.5 80
   2. ip nat inside source static tcp 203.0.113.5 80 192.168.1.10 8080
   3. ip nat outside source static tcp 192.168.1.10 8080 203.0.113.5 80
   4. ip nat inside source static udp 192.168.1.10 8080 203.0.113.5 80
   Show the answer

   Answer: A

   Port forwarding uses static NAT with a protocol and ports: ip nat inside source static tcp local-ip local-port global-ip global-port. Local always comes before global. The ports can differ, which lets you publish an internal port 8080 as port 80.

   • A. This creates a static port mapping: traffic arriving at 203.0.113.5 TCP 80 is forwarded to 192.168.1.10 TCP 8080, and the server's replies are translated back.
   • B. The order is reversed. In ip nat inside source static, the inside local address and port come first, followed by the inside global address and port.
   • C. ip nat outside source translates addresses of hosts on the outside network. The server is an inside host, so the inside source form is required.
   • D. Web traffic uses TCP, not UDP. A UDP mapping would not forward the HTTP connections.

6. Question 6 of 10Config

   Refer to the exhibit. All hosts in 10.1.0.0/16 must reach the internet by sharing the two addresses in pool CORP. Which command completes the configuration?

   interface GigabitEthernet0/0
    ip address 10.1.0.1 255.255.0.0
    ip nat inside
   !
   interface GigabitEthernet0/1
    ip address 198.51.100.2 255.255.255.252
    ip nat outside
   !
   access-list 1 permit 10.1.0.0 0.0.255.255
   ip nat pool CORP 203.0.113.65 203.0.113.66 netmask 255.255.255.248
   ip route 0.0.0.0 0.0.0.0 198.51.100.1

   1. ip nat inside source list 1 pool CORP
   2. ip nat inside source pool CORP list 1 overload
   3. ip nat outside source list 1 pool CORP overload
   4. ip nat inside source list 1 pool CORP overload
   Show the answer

   Answer: D

   PAT can overload a pool as well as an interface address. The ACL selects the inside local addresses, the pool supplies the inside global addresses, and overload adds port translation. The ISP must route the pool addresses back to the router.

   • A. Without overload this is one-to-one dynamic NAT, so only two hosts could be translated at the same time.
   • B. The syntax is wrong. The keyword order is ip nat inside source list ACL pool NAME overload.
   • C. ip nat outside source translates the source addresses of packets arriving from the outside network, not the inside hosts.
   • D. This binds ACL 1 to pool CORP with overload, so the hosts share the two pool addresses using unique port numbers (PAT with a pool).

7. Question 7 of 10Exhibit

   Refer to the exhibit. Hosts on 192.168.50.0/24 cannot reach the internet, and no translations appear. Which two changes are required? (Choose two.)

   interface GigabitEthernet0/0
    description LAN
    ip address 192.168.50.1 255.255.255.0
    ip nat inside
   !
   interface GigabitEthernet0/1
    description ISP
    ip address 198.51.100.2 255.255.255.252
   !
   access-list 10 permit 192.168.50.0 0.0.0.0
   ip nat inside source list 10 interface GigabitEthernet0/1 overload
   ip route 0.0.0.0 0.0.0.0 198.51.100.1

   1. Change the default route next hop to 198.51.100.2.
   2. Change the ACL entry to access-list 10 permit 192.168.50.0 0.0.0.255.
   3. Add ip nat outside to GigabitEthernet0/0.
   4. Replace the interface keyword with a NAT pool, because overload requires a pool.
   5. Add ip nat outside to GigabitEthernet0/1.
   Show the answer

   Answer: B and E

   Two independent faults are present: the outside interface has no ip nat outside, and the ACL wildcard matches one address instead of the subnet. Both must be fixed before any translation appears. Check interface roles and the ACL before suspecting anything else.

   • A. 198.51.100.2 is R1's own address. The next hop 198.51.100.1 is the ISP side of the /30 and is already correct.
   • B. Wildcard 0.0.0.0 matches only the single address 192.168.50.0, which is not a host. Wildcard 0.0.0.255 matches the whole /24.
   • C. GigabitEthernet0/0 faces the LAN and is correctly configured as inside. An interface should not be both, and marking the LAN outside would not fix anything.
   • D. Overload works with the outside interface address; a pool is optional.
   • E. The ISP-facing interface has no NAT role, so traffic never crosses from an inside to an outside interface and nothing is translated.

8. Question 8 of 10Exhibit

   Refer to the exhibit. A new VLAN, 192.168.40.0/24, was connected to R2 on GigabitEthernet0/2. Users on 192.168.30.0/24 browse normally, but users on 192.168.40.0/24 cannot reach the internet. What is the fix?

   R2# show ip nat statistics
   Total active translations: 41 (0 static, 41 dynamic; 41 extended)
   Peak translations: 63
   Outside interfaces:
     GigabitEthernet0/1
   Inside interfaces:
     GigabitEthernet0/0, GigabitEthernet0/2
   Hits: 18342  Misses: 0
   Expired translations: 977
   Dynamic mappings:
   -- Inside Source
   [Id: 1] access-list 30 interface GigabitEthernet0/1 refcount 41
   
   R2# show access-lists 30
   Standard IP access list 30
       10 permit 192.168.30.0, wildcard bits 0.0.0.255 (2210 matches)

   1. Add overload, because the mapping is currently one-to-one dynamic NAT.
   2. Configure ip nat inside on GigabitEthernet0/2.
   3. Add access-list 30 permit 192.168.40.0 0.0.0.255.
   4. Create a NAT pool for the new VLAN, because one interface address can serve only one subnet.
   Show the answer

   Answer: C

   When some inside hosts are translated and others are not, compare their addresses with the ACL that the NAT rule references. Interface roles and the mapping type are visible in show ip nat statistics. Adding a permit entry for the new subnet fixes the problem.

   • A. The mapping uses the outside interface and all 41 translations are extended (port-based), so PAT is already in use.
   • B. GigabitEthernet0/2 is already listed under Inside interfaces, so its NAT role is correct.
   • C. ACL 30 only permits 192.168.30.0/24. Traffic from 192.168.40.0/24 does not match the NAT rule, so it leaves untranslated with a private source address and the replies never come back.
   • D. One PAT address can serve hosts from many subnets; what decides who is translated is the ACL, not the number of subnets.

9. Question 9 of 10Scenario

   You install a new branch router. The LAN interface has ip nat inside, the ISP interface has ip nat outside, the ACL permits the LAN subnet and ip nat inside source list 1 interface GigabitEthernet0/1 overload is configured. A PC pings 198.51.100.10 and fails. show ip nat translations stays empty, and show ip route shows only connected and local routes with Gateway of last resort is not set. What should you do?

   1. Run clear ip nat translation * to rebuild the table.
   2. Remove overload so each host gets its own address.
   3. Add a default route toward the ISP next hop.
   4. Swap the ip nat inside and ip nat outside commands.
   Show the answer

   Answer: C

   NAT does not replace routing. Inside-to-outside packets are routed first and translated second, so a missing route means no translation at all. Check show ip route when the NAT configuration looks correct but the table stays empty.

   • A. Clearing the table removes dynamic entries, but the table is already empty and the packets are still dropped for lack of a route.
   • B. Overload is not the problem, and removing it would leave one interface address for one host only.
   • C. For inside-to-outside traffic, the router routes the packet before translating it. With no route to 198.51.100.10 the packet is dropped, so no translation is created. A default route such as ip route 0.0.0.0 0.0.0.0 pointing to the ISP next hop fixes it.
   • D. The interface roles are already correct: inside on the LAN, outside on the ISP link. Swapping them would break NAT.

10. Question 10 of 10Scenario

    R1 has ip nat inside source static 192.168.1.25 203.0.113.25. An outside host with address 192.0.2.77 sends a packet to 203.0.113.25. No outside NAT is configured. What are the source and destination addresses of that packet when R1 forwards it out its inside interface?

    1. Source 192.0.2.77, destination 192.168.1.25
    2. Source 192.168.1.25, destination 192.0.2.77
    3. Source 192.0.2.77, destination 203.0.113.25
    4. Source 203.0.113.25, destination 192.168.1.25
    Show the answer

    Answer: A

    Static inside NAT works both ways: outbound it changes the source, inbound it changes the destination. The outside host's address is untouched unless outside NAT is configured. In NAT terms, the packet goes from outside global to inside global on the outside and from outside local to inside local on the inside.

    • A. The destination inside global 203.0.113.25 is translated to the inside local 192.168.1.25, and the source 192.0.2.77 stays unchanged because there is no outside NAT (outside local equals outside global).
    • B. These are the addresses of the server's reply before translation, traveling in the opposite direction.
    • C. This is the packet as it arrives on the outside interface. R1 translates the destination inside global address to the inside local address before forwarding it inside.
    • D. R1 does not put its inside global address in the source field of an incoming packet. The outside host's address stays the source.

Common mistakes

• Swapping ip nat inside and ip nat outside: the configuration is accepted, but nothing gets translated because traffic never flows from inside to outside.
• Writing the ACL wildcard wrong, for example 0.0.0.0 instead of 0.0.0.255, so the NAT rule matches one address instead of the whole subnet.
• Forgetting overload on dynamic NAT, so only as many hosts as there are pool addresses can get out at the same time.
• Reversing the address order in static NAT: the inside local address always comes first, then the inside global address.
• Mixing up the four terms: inside global is the public address that represents your inside host, while outside local is how the outside host appears to your inside network.

Questions people ask

More CCNA topics

• CCNA Subnetting Practice Questions
• CCNA OSPF Practice Questions: Single-Area OSPFv2
• CCNA VLANs and Trunking: Practice Questions
• CCNA ACL Practice Questions
• CCNA Spanning Tree Protocol: Practice Questions
• CCNA IPv6 Practice Questions: Addressing, EUI-64, SLAAC and NDP
• CCNA EtherChannel: Practice Questions
• CCNA First-Hop Redundancy Practice Questions: HSRP, VRRP and GLBP
• CCNA Wireless Fundamentals Practice Questions
• CCNA Static Routing Practice Questions: ip route and the Routing Table
• CCNA IP Services Practice Questions
• CCNA Layer 2 Security Practice Questions
• CCNA Security Fundamentals Practice Questions (200-301)
• CCNA QoS Practice Questions (200-301)
• CCNA Automation and Programmability Practice Questions
• CCNA practice test: all domains